Quantum Anonymous Veto with Hardy Paradox 
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The Anonymous Veto (or dining cryptographers) problem, which allows a voting party in a jury 
to anonymously veto a decision, which is to be approved unanimously, has a classical solution in 
form of a protocol, security of which is guaranteed only by computational hardness. We present 
a generalization to a multi qu_Dit case of Hardy's argument against local realism, which avoids 
statistical inequalities, and show that generalized Hardy-type correlations allow a simple quantum 
solution of the problem. This is possible because Hardy-type conditions for correlations precisely 
determine a specific genuine multipartite entangled state, which can satisfy them. 

PACS numbers: 03.67.Mn, 03.65. Ud, 03.67.Dd, 03.67.Ac 



Introduction: In 1964, J.S. Bell, proved that one can 
find measurement correlations for a composite quantum 
system which cannot be described by any local hidden 
variable theory (LHVT) Q. The approach of Bell was 
statistical. Bell's inequalities, in fact, are statistical pre- 
dictions about measurements made on particles far sep- 
arated from each other. A direct contradiction between 
quantum mechanics and local realism was found in 1989 
by Greenberger, Home and Zeilinger (GHZ)Q. In their 
argumentation they used correlations of a state of four 
spin-i particles ^(| 0000) — | 1111)), and remarked that 
for the three-qubit analog of the state their thesis holds 
too. Although their proof is direct, it requires at least 
the eight-dimensional Hilbcrt space and works only for 
the aforementioned states, in contrast to Bell inequalities 
In 1992, Lucien Hardy Q gave a proof of a no-go the- 
orem for local hidden variables which requires only two 
qubits, for almost all pure entangled states, and does not 
require inequalities. We extend the approach of Hardy to 
more complicated situations, and show that Hardy-type 
conditions for correlations precisely determine a specific 
genuine multipartite entangled state [26| . which can sat- 
isfy them. 

The structure of multipartite entanglement is not a 
simple extension of the bipartite one. E.g., for three 
qubits there are two different classes of pure genuinely 
three-partite entanglement, and also one may have en- 
tanglement of just two parties. Most of features of bi- 
partite entanglement are well understood, whereas the 
multipartite entanglement this is still not the case [H- 
14| . The rich structure of the multipartite entanglement 
can be used for various tasks, such as quantum compu- 
tati on jl5l| . quantum simulation 



16 1 , quantum metrol- 



ogy [121 ■ This inspired broad theoretical and experimen- 
We show here that the generalized 



tal studies, 18 



Hardy correlations studied here can be used to construct 
a simple quantum protocol for anonymous veto, which 
is a cryptographic problem with classical solutions, secu- 
rity of which is based on computational hardness, see (2l| 
and Secure protocols for anonymous veto (or re- 

lated "dining cryptographers"), allow to take decisions, 



by some jury, which must be unanimous, without ever 
revealing the possible vetoing party (-ies). Thus, they are 
important in many aspects for functioning of human so- 
cieties. 

Hardy-type argument for arbitrary n-partite system: 
Before describing our test, we briefly mention a general- 
ized form of Hardy's argument and basic related results. 

Consider n subsystems shared among n separated par- 
ties. Assume that i-th party can measure one of two 
observables, Ui and Vi, on the local subsystem. The out- 
comes Xi of each such measurement can be 1,2, c£j. 
Here di is the dimension of Hilbcrt space associated 
to the i-th subsystem. We now consider all the joint 
probabilities P{x\ = X\,x% = x%, = x n ), where 

Xi G {iii, V{}. A Hardy-type argument [4( can start from 
the following set of conditions: 



P(V i : Ui = l) = q>0, 
V r : P(V i r : Ui = 1, v r ^ d r ) = 0, 
P(Vz: v i = di) = 0, 



(1) 



where P(V i : ii = x{) denotes P(x± = xi,X2 = 
X2,---,x n = x n ), and we use the convention n + 1 = 1. 
This set of conditions cannot be satisfied by any LHVT. 

To see this explicitly, let A be a local hidden variable 
(LHV), fully describing the entire system, taking values 
from a set Q and p(X) be the complete state description 
for the joint system. In a LHVT description there ex- 
ists conditional probabilities f(v,j\uj , A), f(vj \vj , A), such 
that P(V i : fj = x<) = J Xen d\p(X) H" =1 f(Xj\xj,\), 
where Xj € {v,j,Vj}. Thus, from the first condition in 
([1]) we see that there exists a hidden variable subset of 
il of a non-zero measure, say Qf, within which for all 
i one has f(l\ui, A) ^ 0, and additionally p(X) ^ 0. 
Now the second condition of (JTJ) provides us for all r, 
f(v r \v r ,X) = for all v r ^ d r and for all A's in fi'. As 
one must have ^2y r = i f {v r \v r , X) = 1, this immediately 
implies that f(d r \v r ,X) — 1 for all X E fl' . Therefore, 

P(V i: h = di) = / Ae0 n"=i /(dr|*r, A) p(X) dX 
> / Ag n<lE=l/(<M*r,A)p(A)dA 
= f Xe0 > PW dX > °> 
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which is in contradiction with the last condition from 
set Hence, conditions (QJ cannot hold for LHVT. 

A similar proof is also given in [22| for a three spins- \ 
system. 

Modified Hardy-type argument for arbitrary n-partite 
system: Similarly to the well-known Hardy conditions 
(TT]), the modified argument for genuine n-partite entan- 
glement also starts from the following set of joint proba- 
bility conditions: 



P(V i : Ui = l) = q>0, 
Vr: P(v r ^ d r , ii r +i = 1) = 0, 
P(V i: Vi = di) = 0, 



(2) 



which, taken together, cannot be satified by any local 
hidden variable theory (LHVT). 

The proof is similar to the previous one. Consider a 
LHVT as above. From the first condition in ^ we see 
that there exists a value range (fi", say) of O within 
which, for all r, all the probabilities f(l\u r ,X) and p(X) 
are all non-zero. The second condition from ([2]) provides 
us for all r, f(v r \v r ,X) = for all A's in ft" and for all 
v r =/= d r . This immediately implies that f(d r \v r ,X) = 1 
for all A e f2". Therefore, P(V i : Vi = df) > 0, which 
contradicts the last condition of ([2]). 

General non-signaling theory ( GNST) satisfying Hardy- 
type argument: In the framework of a general proba- 
bilistic theory, consider a system of n separated parties, 
which together satisfy all the conditions of the modi- 
fied Hardy-type argument, as given by Eqs. (|2|). Then, 
the normalization conditions on the joint probabilities 
P(V i : Xi = Xi) are: 

d\ d2 d n 

E E •••• E /,,:v /: = **) = '• ( 3 ) 

X\—\ X2 — 1 X n —1 

where Xj € {iij,Vj}. 



Let also consider the n-partite system described by a 
general non-signaling theory. For all r, the marginal joint 
probabilities of {l,2,...,n} \ r the following conditions 
must be satisfied: 

Et=i P (V ■ &i = x i,u r = u r ) 

= Z)„ r =i P(V i^r : $i = Xi, v r = v r ). (4) 



is the maximum probability of success, 
i : Ui = 1), of the modified Hardy- type ar- 



What 
P(V 

gument ([2]) under GNST for an n-partite system, 
subject to the constraints given in Eq. Q and Eq. 
(|4|? We have calculated the maximum probability of 
success P{u\ = l,U2 = ljW3 = 1) for three two-level 
system and we have found that the maximum value, 
P(ui = 1,M2 = 1,U3 = l)max is | under GNST. Inter- 
estingly, the maximum probability of success in modified 
Hardy-type argument, g of (J2J, for three two-level 
systems is less than the corresponding two two-level case 
in GNST. Whereas, the maximum probability of success 
of conventional Hardy-type argument (Q]) in GNST 
for both the two two-level systems and three two-level 
systems turns out to be 
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Modified Hardy-type argument and multipartite entan- 
glement: 

Theorem 1. Only a genuine multipartite entangled state 
satisfies the modified Hardy-type conditions (0). 

Proof. Consider state p satisfying conditions ([2]), which is 
not genuinely n-partite entangled, i.e., it is bi-separable 
with respect to some cut, say, (1, 2, m) vs. (m + 1, m + 
2, ....,n). The proof for any other bipartite cut is goes 
along the same line. For the assumed bi-separability, all 
joint probabilities can be expressed as P p (V i : Xi = Xi) = 



T,kPkQk(v i < 



)P fc (V / > m 



.'7 



■>'!) 



Hence all the probabilities involved in condition ([2]) can 
be rewritten in the following way: 



Y,kPkQk{V j <m: iij = 1) i? fe (V l> to : in = 1) = q > 0, 
V r < m : J2kPkQk(i> r ^ d r ,u r+ i = 1) = 0, i.e., Q k (v r ^ d r ,u r +i = 1) = 0, V k, 

Y^kPkQk(v m ^ dm) R k {u m +i = 1) = 0, i.e., Q k (i> m ^ d m ) = 0, V k, (5) 
V I > m : Y,kPk R k(vi ^ d h ui +1 = 1) = 0, i.e.,R k (ii ^ d u u l+ i = 1) = 0, V k, 
Yl k PkQk(ui = 1) Rk(v n ^ d n ) = 0, i.e., Rk(v n d n ) = 0, V k, 
J2kPkQk{y j <m: v 3 ; = dj) R k (y l> m : iii = d t ) = 0. 

From the first and last condition of Eqs. (0 we have 

Qk' ( V j < m : Uj = 1) = q 1 > and R k * ( V I > to : u; = 1) = q 2 > for some k* e {k}, 
and, <3fc(V j < m : v 3 ; = dj) = or R k (V I > m : vi = di) = for all k. (6) 

I 



Eqs. (|S|) and Eqs. © are inconsistent with no- signaling constraint Q. From the last condition of © 
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we must have either Qfc* ( V j < m : 



0, or where |aj| 2 + |/3,| 2 = 1 and < |ay|, \0j\ < 1. The last 



R k * (V I > m : vi = dj) = 
erality, let Qk* ( V j < to : 



0. Without any loss of gcn- 
iii = dj) =0 and from the 



marginal joint probabilities for '{1,2, 
we have, 



, to} \ r' parties 



Zt=iQk>(Vj<r,l>r: 
= Et=iOfc-(Vj<r,J>r 



dj , v r 
— dj . Uf 



= iv, = 1) 
= u r ,ui = 1). 



(7) 

From Eq. ([7]) for r = m we have, Qk* (V j < to : Uj = 
dj, u m = 1) = 0, as all the terms in left-hand side of Eq. 
([7]) are zero by Eq. ([5]), and all terms in right-hand-side 
are non-negative. Similarly, from Eq. ([5]) and Eq. ([7]) 

for r = to — 1 we get 



<2fc* (V j < m - 1 : 



*7 , ^m— 1 



1 



0. 



If we continue this process, we will finally end up with 
Qk* (V j < to : flj = 1) = 0. Hence we reach to a contra- 
diction with conditions (H2). Since the proof is analogous 
for all cuts, no mixture of bi-separable states with respect 
to different cuts can satisfy all the Hardy conditions. □ 

Construction of state satisfying 0): Can one pinpoint 
a class of states which satisfy conditions ([2]), for spe- 
cific pairs of local observables? For this purpose we 
will use a commonly known method, describe in Ref. 
[2~i]] . Let us denote the eigenstatcs of uj and Vj as 
I Uj) and \vj), respectively, where Uj,Vj denote eigenval- 
ues. Let us now look for all the n-partite product states 

\4>k) = | ? 7)i| ? 7)2 \v)ni each of which is associated to 

the zero probabilities given in argument (|2j): 



\<f>k(xi, ..,x r -i,v r ^ d r ,u r+ i = l,x r+ 2, -,x n )) 

= I Xi)....\ X r -l)\ V r d r )\ U r+ i = 1) | X r+2 ) .... \ X„ 

and \<p ) = I Vi = di)\v 2 = d 2 ) \v n = d n ). 



(8) 



It is obvious that all the product states given in Eq. ((HJ 
are not linearly independent. Let there be only s linearly 
independent product states {|0i)}f = i in Eq. (J8j) . It is 
not very difficult to see that | 0o) 1S orthogonal to all the 
states given in Eq. dHJ. Thus, states {| 0i)}f =o are au lin- 
early independent states and span a s + 1-dim. subspace 

Sof Wi 1 ®^ 1 ® ®Hfr. Heres + 1 < d x d 2 d n -l, 

as |0) = |ui = 1)| u a = l)-.|fin = 1> gS. 

To satisfy the conditions given in Eqs. ([2]) , a state p has 



to be confined to the subspace of H 1 1 <8> H2 2 ® • 
which is orthogonal to §, call it a Hardy subspace S -1 . 
Thus, any state p 6 S 1 with (0|p|0) ^ will satisfy 
conditions @. 

Example: 3-qubit Modified Hardy-type state: Let us 
find the set of states p for which the conditions for our 
Hardy-type argument given by Eqns. ([2|) are satisfied for 
a given set of three observable pairs (iij, Vj) (j = 1, 2, 3). 
Take (for all j = 1,2,3): 

|fij = l) = aj\vj = l)+f3j\vj = 2), 
\uj = 2) = p*\i>j = l)-oq\vj = 2), 



condition is due to the non-commutativity of iij and Vj. 
Linearly independent product states associated with the 



zero probabilities in 


Eq 


■ © 


are: 








\<M = 


Vl 


= 2) 


V2 = 


2) 


"3 


= 2) 


\<h) = 


Vl 


= 1) 


U2 = 


1) 


U3 


= 1) 


102) = 


t'l 


= 1) 


U2 = 


1) 


U3 


= 2) 


103) = 


"1 


= 1) 


V2 = 


1) 


U3 


= 1) 


104) = 


"1 


= 2) 


v 2 = 


1) 


U3 


= 1) 


105) = 


til 


= 1) 


u 2 = 


1) 


1 V3 


= 1) 


106) = 




= 1) 


u 2 = 


2) 


1 V3 


= 1) 



The product state associated with the first condition 
reads | 7 ) = | m = 1)\ u 2 = 1)| u 3 = 1). 

State p that corresponds to conditions ([2]), has to be 
confined to a subspace of C 2 (£> C 2 <E) C 2 , which is orthog- 
onal to the subspace § = {| 0j)}f_ o . However, it's not 
orthogonal to the product state | 4>r) . The subspace S 
has dimension seven, so p must be a pure genuine 3- 
qubit entangled state, which we denote as \ip}- As one 
can see, all the eight product states {|0i)}J = o are lin- 
early independent, hence by using the Gram-Schmidt or- 
thonormalization procedure one can find an orthonormal 
basis {|0i)}J =O i m which state \ tp) is its last member, 
with i = 7: 



Wo) = l0o), |#) 



= i0i)-s;=o<0-i0i)i^) 



for i = 1, 7. 



The probability q in the conditions ([2j, for the Hardy 
state, reads 



I(^|07)| 5 



i=0 



I(0^I07)| 5 



|q;iq; 2 q; 3 | 2 |/3i/3 2 /33| 
1 - \aia 2 a 3 \ 2 



Its maximum possible value is 0.0181938. Further exam- 
ples of Hardy states for bipartite cases can be found in 

We have also checked that for qubit systems, only a 
unique pure genuinely multipartite entangled state satis- 
fies all conditions <j2j) (See the Supplementary Material). 
Thus, an important feature of original Hardy-type two- 
qubit argument is preserved. This feature is missing in 
most other multipartite Bell-type tests and totally ab- 
sent in the case of generalized Hardy-type argument (TTJ) 
for more than two-qubit case. 

Quantum Anonymous Veto Protocol: Imagine a jury 
with N members, who need to take an unanimous deci- 
sion, but at the same time want their individual decisions 
to remain secret. Hardy conditions 

P(V i : it, = +1) = q > 0, (9) 
V r < N : P(v r = +1, u r+1 = +1) = 0, (10) 
P(V i : Vi = -1) = (11) 

would allow them to achieve this. We shall present a 



specific case for q 



2™(2«-l) 1 
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Imagine that the obscrvablcs in the above conditions 
are, say, ilk = o~ z and % = — a x . In such a case only the 
following state has the properties (f9"] [TTj) 



\<t> 



1 



V2 N -1 



2— II 



(12) 



where |+) = ^= [|0) + Here the computational basis 
is the one of a z , and |+) is the —1 eigenstate of — a x . 
Note, that due to the symmetry of the state with respect 
to any permutation of the qubits, the condition ([10[) can 
be replaced by a more general one: V r / s : P{v r = 
+l,w s = +l) = 0. 

Each jury member receives one of the qubits, and can 
make secret measurements on them. The local measur- 
ing devices provide a choice between the two observables 
mentioned above (settings). Choosing Uk represents be- 
ing "in favor", "vetoing" is represented by Vk- 

A high repetition rate (event ready) quantum interfer- 
ometric device [27[, sends qubits in the state to the jury 
members. Before every run, each of the members ran- 
domly chooses whether this run would be a voting one 
or testing one. The testing runs may use different set- 
tings, and their results and settings are announced (after 
the measurements are done). Testing measurements in 
principle perform a kind of state tomography, or state 
witness operation, which assures that the delivered state 
is indeed (fT2j) . Details can be spared. Otherwise, the jury 
members choose the setting corresponding to his/her own 
opinion and collect the measurement data. They send 
data to the referee after a certain data processing, de- 
scribed below. 

Each jury member has a list of results under vot- 
ing settings, correlated with the timing of the measure- 
ments. Those who vetoed randomly reject the runs, 
which yielded the outcome '+1' until the proportion be- 
tween '+l's and '— l's in their table is 1 : (2^ — 2), as 
such would be the local statistics for those who were in 
favor. Next, all jury members randomly further reduce 
their lists by a certain big enough factor to a fixed (for all 
the same) number of entries. This is to hide how many 
results were rejected in the first step and hence again 
hide members' individual decisions. Next, each partner 
sends the list of their reduced samples (i.e., the timing 
information of the selected events, but not their results) 
to the referee. The referee finds a common part of the 
lists of the timings. The list of common timings must be 
very large. This can be guaranteed by the high repetition 
rate of the source. 

The referee then asks a random jury member at a time 
about his/her result in a randomly chosen run in the 
common part, and continues this procedure until in this 
way patiently collects all the results related with the runs 
that were sharing timing. The referee has all results for 
each run associated with a common timing, Xi(Tk) = ±1, 
where i denotes a jury member, and Tk is the timing. 



If any jury member vetoes, but there was a dis- 
agreement, due to the condition (fTOj) . one cannot have 
Ef = i^(T fc ) = TV for any k. Thus if in the collected data 
the referee does not see strings of results related with 
the same Tk which have all +l's, he/she can safely (high 
statistics!) conclude that somebody was vetoing. How- 
ever, if such a string is occurring (many times, we assume 
big statistics), the vote must be unanimous, because of 
© and the fact that for the state P(V i : Vi = +1) > 0. 
If there is no string related to a common Tk with all re- 
sults — 1, everybody must have been against, see (|11|) . 
Otherwise, the vote is unanimously in favour, as for the 
state P(V i : Ui = -1) > 0. 

This protocol requires many runs of the experiment. 
First, each jury member has to reject a fraction of lo- 
cal results, the referee accepts only the common part 
of the reduced lists, and still this common part must 
be large enough for the probability of having +l's at 
some position of all lists (which happens with probabil- 
ity 2~ N (2 N — 1)) to be sufficiently large. This resembles 
the case of quantum key distribution, where a large part 
of data is spent on privacy amplification [25[ . Here, the 
privacy is protected at two levels. First, the individual 
opinions are hidden by the corrections of local statistics. 
Second, the opinions are additionally protected by the 
symmetry of the state distributed among the partners. 
As the state is invariant under permutations of particles, 
P{u r = i, v r+ i = j) = P(v r = j, u r+ i = i) for i, j = ±1, 
e.t.c. 

In summary, our modified Hardy-type test does not in- 
volve any statistical inequality. For n qubit systems, we 
prove the uniqueness and purity of the Hardy state, and 
for the general case its genuine n-partite entanglement. 
We show that multi-qubit Hardy correlations allow one 
to find a simple anonymous veto protocol. Finally we 
remark that we also studied the maximum probability of 
success, q, of the modified Hardy-type test @ for three 
two-level systems under a generalized non-signaling the- 
ory and in quantum theory. We found that the maximum 
value of the probability for quantum theory is 0.0181938, 
and for GNST it is 1/3. Interestingly, for both cases 
maximal q is lower than for two two qubits. 
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I 

Proof of the Uniqueness of the Hardy State for Qubit Systems 

Let us put the n-qubit modified Hardy's conditions: 

P(V i : u l = +l) = q>0, (13) 
V r < n : P{v r = +l,U r +i = +1) = 0, (14) 
P(Wi : v i = -l) = 0, (15) 

Lemma 1.1. Only a unique pure genuinely entangled n qubit state satisfies \1 3Vll5\) . 

Proof: We show the uniqueness proof only, the proof for the genuineness is already given in the main article. Let 
us denote the eigenstates of iij (dj) with eigenvalue +1 and —1 by |0j)(| +).,•) and respectively. Let us 

also denote the n-qubit product states associated to the zero probabilities given in Eqn. (fl"4|) as 

\4>(xi, ..,X2,+r, 0r+l, X r+2 , ..,£„)) = I Xl) ....\ X r -l) \ + r )\ r +l)\ X r+ 2).--\ X n ) , (16) 

where | Xj) £ {\ 0j), \ lj), \ \ and the product states associated to the zero probability given in Eqn. (fT5|) as 



The product state 



|0o> = |->|-) I-}- 

!</>+) = I o)| o)....|o)....|o>, 



(17) 
(18) 
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is associated with the non-zero probability given in Eqn. (|T5|) . Note that the states given in Eqns. (|16H18j) are not 
linearly independent. Let's define a new product basis: 

| 00...0...0) = J 0+) 
I 00.. . 01,0.. .0) = £ [| fe (O, .., 0, +,, 0, 0)) - ai\ 0+)] , 

| 0...01j0...01 TO 0...0) = <fe(0, 0, +,, 0, 0, + m , 0, 0)) - aia m \ </)+) 

-Pi<x m \ 00...01,0...0) - ai0 m \ 00...01 m 0...0)], 
| 0...01 ; 0...01 TO 0...01 fc 0...0) = jj^W fo(0, •••> 0, +1,0, 0, + m , 0, 0, + fc , 0, 0)) - aia m a k \ 0+) 
- ai a m k \ 00...01 fc 0...0) - ai/3 m a k \ 00...01 m 0...0) - Aa TO a ft | 00...01,0...0) 
-aiP m p k \ 00...01 ro 0...01 fe 0...0) - PtctmPkl 00...01j0...01 fc 0...0) - A/3 m a fe | 00...01,0...01 m 0...0)], 



1 = n ^ f [| </> ) - E?=i li; 1 00...01.0...0) + ... + (-1)- EILi li: n...i0ii...i>], 

where | +) J = a,-| Q)j + j3j\ and | -)j = f3* \ 0)j - a* \ l)j with |a| 2 + \/3\ 2 = 1. Therefore, the product states given 
in Eqns. (|16H18p span the full 2 n -dim. Hilbert space Cf ® Cf ® ■ ■ . (?) C 2 . Let 5i = {| <£(xi, ■ ■, ^2, +r, r+ i, x r+2 , ..,a; n ))}, 
be the subspace spanned by the product states given in Eqn. p^|) . Now | </>+) JL | <fio), whereas | cf>o) _L <Si, therefore, 
I </>+) Si. Also, I 4>o) and | are linearly independent and Si U {| 4>o), \ 4>+)} is 2™-dimensional, therefore, Si must 
be a (2™ — 2)-dimensional subspace of C\ £g> Cf (8) ... <g> C 2 . Hence, the dimension of <Si U {| (f>o)} (= S) is 2" — 1. 

To satisfy the conditions given in Eqns. (|13H15j) . a density operator p has to be orthogonal to the subspace S (of 
C\ <8> Cf <g) ... <E> C 2 ) spanned by the product states given in Eqns. (| 1 641 1 7() . So p must have rank one and it is unique, 
i.e., p is a unique pure entangled state \ip) (ip\ of n-qubits, and one has q = \ (ip\(j) + ) | 2 > 0. 



